As a Learning Management System, Canvas by default contains personal data of staff and students. Additional information of students may be collected or included through the use of assessment tools and other features. Therefore, teaching staff in a course site (and administrative staff in an organization) are also responsible for protecting data privacy on Canvas. Personal data, in general, should be avoided to be shared or uploaded to the Canvas site.
More information on data privacy can be found at
University Data Protection page and the
Office of the Privacy Commissioner for Personal Data (PCPD).